• OpenVPN has released critical security updates for its 2.6 stable and 2.7 development branches, addressing three vulnerabilities that could lead to local denial-of-service (DoS), security bypasses, and buffer over-reads.

    The patches, included in the newly released version 2.6.17 and 2.7_rc3, fix issues ranging from logic errors in HMAC verification to stability flaws in the Windows interactive service.

    Administrators are urged to upgrade immediately, particularly those running OpenVPN on Windows or utilizing the 2.7 release candidates.​

    Windows Interactive Service DoS (CVE-2025-13751)

    The most significant issue for Windows environments is CVE-2025-13751, a local denial-of-service vulnerability affecting the interactive service component.

    The flaw involves an erroneous exit routine where the service shuts down completely upon encountering specific error conditions, rather than logging the error and continuing operations.​

    This vulnerability can be triggered by any authenticated local user, making it a moderate risk for multi-user Windows systems.

    Once triggered, the OpenVPN service terminates, preventing any new VPN connections until the service is manually restarted or the system is rebooted. This issue affects OpenVPN versions 2.6.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2. It is resolved in 2.6.17 and 2.7_rc3.​

    HMAC Verification Bypass (CVE-2025-13086)

    A serious logic flaw, identified as CVE-2025-13086, was found in the HMAC verification check used during the 3-way handshake. Due to an inverted memcmp() call in the code, the system inadvertently accepted all HMAC cookies, effectively neutralizing source IP address validation.​

    This failure allows attackers to bypass the initial verification layer, potentially opening TLS sessions and consuming server state from IP addresses that did not initiate a legitimate connection.

    The update also enforces stricter timeslot checks, rejecting HMACs from future timestamps. This vulnerability affects versions 2.6.0 through 2.6.15 and is fixed in 2.6.16 (and included in 2.6.17).​

    IPv6 Buffer Over-Read (CVE-2025-12106)

    For users on the development branch (2.7 series), CVE-2025-12106 presents a high-severity memory safety issue. The vulnerability stems from a mismatched address family check in the get_addr_generic function, which can lead to a heap buffer over-read when parsing invalid IPv6 input.​

    While this flaw has been rated with a critical CVSS score of 9.1 in some reports due to its potential for memory corruption, it is strictly limited to the 2.7_alpha1 through 2.7_rc1 builds and does not affect the stable 2.6 branch.​

    The following table summarizes the vulnerabilities and the required versions to mitigate them. Users on the stable branch should target 2.6.17, while testing branch users must update to 2.7_rc3.

    CVE IDVulnerability TypeImpactAffected VersionsFixed In
    CVE-2025-13751Local DoSService crash on Windows2.6.0–2.6.16
    2.7_alpha1–2.7_rc2
    2.6.17
    2.7_rc3
    CVE-2025-13086Security BypassHMAC check failure2.6.0–2.6.15
    2.7_alpha1–2.7_rc1
    2.6.16
    2.7_rc2
    CVE-2025-12106Buffer Over-readInvalid IPv6 parsing2.7_alpha1–2.7_rc12.7_rc2

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post OpenVPN Vulnerabilities Let Hackers Triggers Dos Attack and Bypass Security Checks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google on Monday released monthly security updates for the Android operating system, including two vulnerabilities that it said have been exploited in the wild. The patch addresses a total of 107 security flaws spanning different components, including Framework, System, Kernel, as well as those from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison. The two high-severity shortcomings

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has released critical security patches addressing two high-severity zero-day vulnerabilities in Android that are currently being exploited in limited, targeted attacks. The vulnerabilities, disclosed in the December 2025 Android Security Bulletin, affect multiple Android versions and require immediate attention from device manufacturers and users. Active Exploitation Confirmed The two CVEs under active exploitation, CVE-2025-48633 […]

    The post Google Fixes Android Zero-Day Flaws Actively Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A new security flaw has been found in Apache Struts, a popular open‑source web application framework used by many companies worldwide. The issue, tracked as CVE‑2025‑64775, could allow attackers to fill a server’s disk space, causing it to stop working correctly. Field Details CVE ID CVE-2025-64775 Vulnerability Title Apache Struts flaw allows attackers to launch disk […]

    The post Apache Struts Flaw Allows Attackers to Launch Disk Exhaustion Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security threats rarely adhere to holiday schedules, and while developers may take time off, malicious actors are working overtime. A significant new wave of software supply chain attacks has been identified targeting the Microsoft Visual Studio Marketplace and OpenVSX platforms. Researchers at Secure Annex have uncovered and tracked 24 new malicious packages linked to the […]

    The post Glassworm Malware Targets OpenVSX and Microsoft Visual Studio with 24 New Malicious Packages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenAI’s Codex CLI, a command-line tool designed to bring AI-powered reasoning into developer workflows, contains a critical vulnerability that allows attackers to execute arbitrary commands on developer machines without any user interaction or approval. Security researchers Isabel Mill and Oded Vanunu discovered the flaw, tracked as CVE-2025-61260, on December 1, 2025. Attribute Details CVE ID CVE-2025-61260 […]

    The post OpenAI Codex CLI Flaw Allows Attackers to Run Arbitrary Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Koi researchers have uncovered a seven-year browser extension operation that has silently compromised at least 4.3 million Chrome and Edge users worldwide. The threat actor, dubbed ShadyPanda, systematically abused browser marketplaces to turn seemingly legitimate extensions into long‑term surveillance and remote access platforms. Koi’s investigation identified two ongoing campaigns linked to the same actor. A 300,000‑user remote […]

    The post 4.3 Million Chrome and Edge Users Hacked in 7-Year ShadyPanda Malware Campaign appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • South Korean e-commerce giant Coupang has admitted to a significant data breach that exposed the personal information of about 33.7 million customers. This figure is close to the company’s entire user base, making it one of the most significant known data breaches in the country. According to Coupang, the stolen data includes names, phone numbers, […]

    The post Coupang Data Breach Exposes Personal Information of 33.7 Million Customers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a significant decision that will affect millions of mobile phone users, the Indian government has ordered all smartphone companies to install a specific security app on every new device sold in the country. The Department of Telecommunications (DoT) issued this order on November 28, 2025. The government has told phone makers that they have […]

    The post Mandatory ‘Undeletable’ Security App to Be Installed on Every Smartphone in India appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Senate and House Armed Services committees will open bipartisan inquiries into U.S. military strikes on suspected drug-running boats in the Caribbean Sea, with a focus on an alleged follow-on attack that The Washington Post reported killed two survivors of the initial operation.

    Senate Armed Services Committee Chair Roger Wicker, R-Miss., and ranking member Jack Reed, D-R.I., issued a joint statement Friday promising “vigorous oversight” of the killings.

    “The Committee is aware of recent news reports — and the Department of Defense’s initial response — regarding alleged follow-on strikes on suspected narcotics vessels in the SOUTHCOM (Southern Command) area of responsibility. The Committee has directed inquiries to the Department, and we will be conducting vigorous oversight to determine the facts related to these circumstances,” Wicker and Reed said.

    Similarly, House Armed Services Committee Chair Mike Rogers, R-Ala., and ranking member Adam Smith, D-Wash., said in a joint statement Saturday that the panel “is committed to providing rigorous oversight of the Department of Defense’s military operations in the Caribbean.”

    “We take seriously the reports of follow-on strikes on boats alleged to be ferrying narcotics in the SOUTHCOM region and are taking bipartisan action to gather a full accounting of the operation in question,” according to the statement.

    The inquiries mark a rare bipartisan check on President Donald Trump’s administration since his second term began in January. With the exception of voting to release the federal case files on convicted sex offender Jeffrey Epstein, which Trump eventually endorsed, Republicans have largely left Trump’s decisions and policies unchallenged.

    Follow-on attack reported

    Lawmakers’ attention was retrained on the already legally questionable U.S. operations targeting alleged narcotics boats after an investigative report published Friday by The Washington Post revealed Secretary of Defense Pete Hegseth gave verbal orders to kill everyone during a Sept. 2 operation —  the first of several U.S. boat strikes in the Caribbean Sea that have killed roughly 80.

    According to the report, two survivors clung to burning wreckage after an initial hit. Adm. Frank M. “Mitch” Bradley, who was commanding the attack from Fort Bragg in North Carolina, ordered a second, or follow-on, strike to fulfill Hegseth’s order and kill the remaining survivors. States Newsroom has not independently confirmed the details.

    Hegseth called the report “fabricated, inflammatory, and derogatory,” in a post on social media Friday.

    Sen. Tim Kaine, D-Va., told CBS News’ “Face the Nation with Margaret Brennan” on Sunday that the follow-on strike could rise “to the level of a war crime if it’s true.”

    "If that reporting is true, it's a clear violation of the DoD's own laws of war, as well as international laws about the way you treat people who are in that circumstance," Kaine said.

    A working group of former military lawyers issued a statement Friday urging Congress to investigate the Sept. 2 strike.

    “Since orders to kill survivors of an attack at sea are ‘patently illegal,’ anyone who issues or follows such orders can and should be prosecuted for war crimes, murder, or both,” according to the statement published by Just Security, a journal focused on national security published by the New York University School of Law Reiss Center on Law and Security.

    A bipartisan effort, led by Kaine, to stop Trump’s deadly strikes in the Caribbean narrowly failed in the Senate in early November.

    White House confirms second strike

    White House press secretary Karoline Leavitt was met with numerous questions about the Post report at Monday’s press briefing.

    A reporter asked Leavitt, “Does the administration deny that that second strike happened, or did it happen and the administration denies that Secretary Hegseth gave the order?”

    “The latter is true, and I have a statement to read for you here,” Leavitt said, adding that Trump and Hegseth have authority to conduct lethal attacks on designated narco-terrorist groups.

    “With respect to the strikes in question on Sept. 2, Secretary Hegseth authorized Admiral Bradley to conduct these kinetic strikes,” she said. “Admiral Bradley worked well within his authority and the law directing the engagement to ensure the boat was destroyed and the threat to the United States of America was eliminated.”

    Leavitt’s statement was not entirely consistent with Hegseth’s denial on Friday, in which he called the reporting “fabricated.”

    Trump echoes Hegseth denial

    Trump told reporters aboard Air Force One on Sunday he “wouldn’t have wanted that” when asked about the alleged follow-on strike that killed the two survivors.

    “The first strike was very lethal. It was fine, and if there were two people around — but Pete [Hegseth] said that didn't happen,” Trump told reporters. 

    “Pete said he did not order the death of those two men,” Trump continued in a back-and-forth with the press.

    Trump also said Saturday he was closing the airspace above Venezuela, but tolda reporter who asked Sunday if the move previewed a U.S. airstrike of the country not to “read anything into it.”

    “To all Airlines, Pilots, Drug Dealers, and Human Traffickers, please consider THE AIRSPACE ABOVE AND SURROUNDING VENEZUELA TO BE CLOSED IN ITS ENTIRETY,” he wrote on his own social media platform just before 8 a.m. Eastern Saturday.

    Trump confirmed reports he spoke to Venezuelan President Nicolás Maduro late last month but would not reveal details of the conversation.

    The U.S. has been amassing Navy vessels and troops off the coast of Venezuela for months, including the recent addition in mid-November of the Navy’s most advanced aircraft carrier, the USS Gerald Ford.

    This story was originally published by Stateline.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶